CVE-2013-0172: Samba

Low severity, CVSS 3.5. EPSS: 2.4% chance of exploitation in the next 30 days.

Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not properly interpret Access Control Entries that are based on an objectClass, which allows remote authenticated users to bypass intended restrictions on modifying LDAP directory objects by leveraging (1) objectClass access by a user, (2) objectClass access by a group, or (3) write access to an attribute.

Affected products

• Samba Samba: version 4.0.0 only

Published 2013-01-17. Last modified 2026-06-16.